{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9970574378967285, "class": 2 } ], "prob": 0.99705744, "class": 2, "models": [ { "m": "az", "prob": 0.8166376, "class": 0 }, { "m": "az/scripts", "prob": 0.84530693, "class": 0 }, { "m": "az/php", "prob": 0.99705744, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-08T23:33:04Z" }, "path": "antibots2.php", "raw": { "v": "4", "fs": [ { "f": "O₄(As₂C₂DyI₂)H₂(CmF)Md", "k": { "source.imports[0]": "fclose", "source.imports[1]": "file", "source.imports[2]": "fopen", "source.imports[3]": "fputs", "source.imports[4]": "fwrite", "source.imports[5]": "getenv", "source.imports[6]": "gethostbyaddr", "source.imports[7]": "header", "source.imports[8]": "in_array", "source.imports[9]": "preg_match", "source.strings[0]": " [OR]\nRewriteRule ^.* - [F,L]\n", "source.strings[1]": "$hits[0]", "source.strings[2]": "68.65.53.71", "source.strings[3]": "\u003ch1\u003e404 Not Found\u003c/h1\u003eThe page that you have requested could not be found.", "source.strings[4]": "Deny from ", "source.strings[5]": "Deny from $a", "source.strings[6]": "HOSTNAME", "source.strings[7]": "HTTP/1.0 404 Not Found", "source.strings[8]": "HTTP_USER_AGENT", "source.strings[9]": "REMOTE_ADDR", "source.has_imports": true, "source.imports[10]": "substr_count", "source.strings[10]": "RewriteEngine on\nOptions +FollowSymlinks\nRewriteCond %{HTTP_USER_AGENT} ^", "source.strings[11]": "RewriteEngine on\nOptions +FollowSymlinks\nRewriteCond %{HTTP_USER_AGENT} ^$b [OR]\nRewriteRule ^.* - [F,L]\n", "source.strings[12]": "^107.170.*.*", "source.strings[13]": "^109.186.*.*", "source.strings[14]": "^12.148.196.*", "source.strings[15]": "^12.148.209.*", "source.strings[16]": "^128.242.*.*", "source.strings[17]": "^131.212.*.*", "source.strings[18]": "^149.20.*.*", "source.strings[19]": "^158.108.*.*", "source.strings[20]": "^167.24.*.*", "source.strings[21]": "^168.188.*.*", "source.strings[22]": "^173.194.*.*", "source.strings[23]": "^184.173.*.*", "source.strings[24]": "^192.115.134.*", "source.strings[25]": "^192.118.48.*", "source.strings[26]": "^193.220.178.*", "source.strings[27]": "^193.253.199.*", "source.strings[28]": "^193.47.80.*", "source.strings[29]": "^194.52.68.*", "source.strings[30]": "^194.72.238.*", "source.strings[31]": "^194.90.*.*", "source.strings[32]": "^198.25.*.*", "source.strings[33]": "^198.54.*.*", "source.strings[34]": "^199.30.228.*", "source.strings[35]": "^202.108.252.*", "source.strings[36]": "^204.14.48.*", "source.strings[37]": "^206.28.72.*", "source.strings[38]": "^207.126.144.*", "source.strings[39]": "^208.65.144.*", "source.strings[40]": "^208.91.115.*", "source.strings[41]": "^209.73.228.*", "source.strings[42]": "^209.85.*.*", "source.strings[43]": "^209.85.128.*", "source.strings[44]": "^212.143.*.*", "source.strings[45]": "^212.150.*.*", "source.strings[46]": "^212.235.*.*", "source.strings[47]": "^212.29.192.*", "source.strings[48]": "^212.29.224.*", "source.strings[49]": "^212.50.193.*", "source.strings[50]": "^216.239.32.*", "source.strings[51]": "^216.252.167.*", "source.strings[52]": "^217.132.*.*", "source.strings[53]": "^38.100.*.*", "source.strings[54]": "^38.105.*.*", "source.strings[55]": "^38.144.36.*", "source.strings[56]": "^46.116.*.* ", "source.strings[57]": "^50.7.*.*", "source.strings[58]": "^50.97.*.*", "source.strings[59]": "^54.176.*.*", "source.strings[60]": "^62.116.207.*", "source.strings[61]": "^62.90.*.*", "source.strings[62]": "^64.106.213.*", "source.strings[63]": "^64.124.14.*", "source.strings[64]": "^64.18.*.*", "source.strings[65]": "^64.233.160.*", "source.strings[66]": "^64.27.2.*", "source.strings[67]": "^64.37.103.*", "source.strings[68]": "^64.62.136.*", "source.strings[69]": "^64.62.175.*", "source.strings[70]": "^66.102.*.*", "source.strings[71]": "^66.135.200.*", "source.strings[72]": "^66.150.14.*", "source.strings[73]": "^66.205.64.*", "source.strings[74]": "^66.207.120.*", "source.strings[75]": "^66.221.*.*", "source.strings[76]": "^66.249.*.*", "source.strings[77]": "^67.15.*.*", "source.strings[78]": "^67.209.128.*", "source.strings[79]": "^69.61.12.*", "source.strings[80]": "^69.65.*.*", "source.strings[81]": "^72.14.192.*", "source.strings[82]": "^74.125.*.*", "source.strings[83]": "^81.161.59.*", "source.strings[84]": "^82.166.*.*", "source.strings[85]": "^85.250.*.*", "source.strings[86]": "^85.64.*.*", "source.strings[87]": "^89.138.*.*", "source.strings[88]": "^91.103.66.*", "source.strings[89]": "^93.172.*.*", "source.strings[90]": "amazonaws", "source.strings[91]": "antibots.txt", "source.strings[92]": "calyxinstitute", "source.strings[93]": "crawler", "source.strings[94]": "cyveillance", "source.strings[95]": "dreamhost", "source.strings[96]": "google", "source.strings[97]": "messagelabs", "source.strings[98]": "msnbot", "source.strings[99]": "netcraft", "source.strings[100]": "netpilot", "source.strings[101]": "newips.php", "source.strings[102]": "p3pwgdsn", "source.strings[103]": "paypal", "source.strings[104]": "phishtank", "source.strings[105]": "softlayer", "source.strings[106]": "sucuri.net", "source.strings[107]": "tor-exit", "source.strings[108]": "torservers", "source.strings[109]": "trendmicro" }, "x": 2, "id": 0, "is": [ "in_array", "header", "preg_match", "header", "gethostbyaddr", "substr_count", "header", "file", "fopen", "fputs", "fclose", "getenv", "getenv", "getenv", "fopen", "fwrite", "gethostbyaddr", "substr_count", "header" ], "ms": { "file": { "size": 4610.0 }, "text": { "digit_ratio": 0.49, "space_count": 472.0, "total_lines": 52.0, "char_entropy": 5.07, "unique_chars": 78.0, "import_density": 36.54, "lines_over_200": 2.0, "lines_over_500": 1.0, "string_density": 8.73, "avg_line_length": 87.67, "lines_over_1000": 1.0, "max_line_length": 2668.0, "empty_line_ratio": 0.04, "last_line_length": 2.0, "most_common_char": ".", "whitespace_ratio": 0.11, "most_common_ratio": 0.11, "identifier_density": 1.19, "line_length_stddev": 365.19, "normalized_import_count": 2.63, "normalized_string_count": 62.96, "repeated_char_sequences": 3.0, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 1.0, "suspicious_identifier_ratio": 0.16, "normalized_unique_identifiers": 4.39 }, "imports": { "total": 19.0, "unique_modules": 11.0, "third_party_count": 19.0, "third_party_ratio": 1.0 }, "strings": { "total": 454.0, "ip_count": 4.0, "avg_length": 12.5, "max_length": 105.0, "avg_entropy": 2.8, "total_bytes": 5676.0, "domain_count": 2.0, "entropy_stddev": 0.52, "high_entropy_count": 1.0 }, "comments": {}, "functions": {}, "identifiers": { "total": 62.0, "avg_length": 5.8, "max_length": 13.0, "min_length": 1.0, "avg_entropy": 2.0, "reuse_ratio": 0.4, "unique_count": 25.0, "length_stddev": 3.69, "sequential_names": 4.0, "single_char_count": 4.0, "single_char_ratio": 0.16, "all_lowercase_ratio": 0.92, "all_uppercase_ratio": 0.04, "underscore_prefix_count": 1.0 } }, "ss": [ [ 43, "^81.161.59.*" ], [ 44, "^81.161.59.*" ], [ 59, "^66.135.200.*" ], [ 60, "^66.135.200.*" ], [ 76, "^66.102.*.*" ], [ 77, "^66.102.*.*" ], [ 91, "^38.100.*.*" ], [ 92, "^38.100.*.*" ], [ 106, "^107.170.*.*" ], [ 107, "^107.170.*.*" ], [ 122, "^149.20.*.*" ], [ 123, "^149.20.*.*" ], [ 137, "^38.105.*.*" ], [ 138, "^38.105.*.*" ], [ 152, "^74.125.*.*" ], [ 153, "^74.125.*.*" ], [ 168, "^66.150.14.*" ], [ 169, "^66.150.14.*" ], [ 184, "^54.176.*.*" ], [ 185, "^54.176.*.*" ], [ 199, "^38.100.*.*" ], [ 200, "^38.100.*.*" ], [ 214, "^184.173.*.*" ], [ 215, "^184.173.*.*" ], [ 230, "^66.249.*.*" ], [ 231, "^66.249.*.*" ], [ 245, "^128.242.*.*" ], [ 246, "^128.242.*.*" ], [ 261, "^72.14.192.*" ], [ 262, "^72.14.192.*" ], [ 277, "^208.65.144.*" ], [ 278, "^208.65.144.*" ], [ 294, "^74.125.*.*" ], [ 295, "^74.125.*.*" ], [ 309, "^209.85.128.*" ], [ 310, "^209.85.128.*" ], [ 326, "^216.239.32.*" ], [ 327, "^216.239.32.*" ], [ 343, "^74.125.*.*" ], [ 344, "^74.125.*.*" ], [ 358, "^207.126.144.*" ], [ 359, "^207.126.144.*" ], [ 376, "^173.194.*.*" ], [ 377, "^173.194.*.*" ], [ 392, "^64.233.160.*" ], [ 393, "^64.233.160.*" ], [ 409, "^72.14.192.*" ], [ 410, "^72.14.192.*" ], [ 425, "^66.102.*.*" ], [ 426, "^66.102.*.*" ], [ 440, "^64.18.*.*" ], [ 441, "^64.18.*.*" ], [ 454, "^194.52.68.*" ], [ 455, "^194.52.68.*" ], [ 470, "^194.72.238.*" ], [ 471, "^194.72.238.*" ], [ 487, "^62.116.207.*" ], [ 488, "^62.116.207.*" ], [ 504, "^212.50.193.*" ], [ 505, "^212.50.193.*" ], [ 521, "^69.65.*.*" ], [ 522, "^69.65.*.*" ], [ 535, "^50.7.*.*" ], [ 536, "^50.7.*.*" ], [ 548, "^131.212.*.*" ], [ 549, "^131.212.*.*" ], [ 564, "^46.116.*.* " ], [ 565, "^46.116.*.* " ], [ 580, "^62.90.*.*" ], [ 581, "^62.90.*.*" ], [ 594, "^89.138.*.*" ], [ 595, "^89.138.*.*" ], [ 609, "^82.166.*.*" ], [ 610, "^82.166.*.*" ], [ 624, "^85.64.*.*" ], [ 625, "^85.64.*.*" ], [ 638, "^85.250.*.*" ], [ 639, "^85.250.*.*" ], [ 653, "^89.138.*.*" ], [ 654, "^89.138.*.*" ], [ 668, "^93.172.*.*" ], [ 669, "^93.172.*.*" ], [ 683, "^109.186.*.*" ], [ 684, "^109.186.*.*" ], [ 699, "^194.90.*.*" ], [ 700, "^194.90.*.*" ], [ 714, "^212.29.192.*" ], [ 715, "^212.29.192.*" ], [ 731, "^212.29.224.*" ], [ 732, "^212.29.224.*" ], [ 748, "^212.143.*.*" ], [ 749, "^212.143.*.*" ], [ 764, "^212.150.*.*" ], [ 765, "^212.150.*.*" ], [ 780, "^212.235.*.*" ], [ 781, "^212.235.*.*" ], [ 796, "^217.132.*.*" ], [ 797, "^217.132.*.*" ], [ 812, "^50.97.*.*" ], [ 813, "^50.97.*.*" ], [ 826, "^217.132.*.*" ], [ 827, "^217.132.*.*" ], [ 842, "^209.85.*.*" ], [ 843, "^209.85.*.*" ], [ 857, "^66.205.64.*" ], [ 858, "^66.205.64.*" ], [ 873, "^204.14.48.*" ], [ 874, "^204.14.48.*" ], [ 889, "^64.27.2.*" ], [ 890, "^64.27.2.*" ], [ 903, "^67.15.*.*" ], [ 904, "^67.15.*.*" ], [ 917, "^202.108.252.*" ], [ 918, "^202.108.252.*" ], [ 935, "^193.47.80.*" ], [ 936, "^193.47.80.*" ], [ 951, "^64.62.136.*" ], [ 952, "^64.62.136.*" ], [ 967, "^66.221.*.*" ], [ 968, "^66.221.*.*" ], [ 982, "^64.62.175.*" ], [ 983, "^64.62.175.*" ], [ 998, "^198.54.*.*" ], [ 999, "^198.54.*.*" ], [ 1013, "^192.115.134.*" ], [ 1014, "^192.115.134.*" ], [ 1031, "^216.252.167.*" ], [ 1032, "^216.252.167.*" ], [ 1049, "^193.253.199.*" ], [ 1050, "^193.253.199.*" ], [ 1067, "^69.61.12.*" ], [ 1068, "^69.61.12.*" ], [ 1082, "^64.37.103.*" ], [ 1083, "^64.37.103.*" ], [ 1098, "^38.144.36.*" ], [ 1099, "^38.144.36.*" ], [ 1114, "^64.124.14.*" ], [ 1115, "^64.124.14.*" ], [ 1130, "^206.28.72.*" ], [ 1131, "^206.28.72.*" ], [ 1146, "^209.73.228.*" ], [ 1147, "^209.73.228.*" ], [ 1163, "^158.108.*.*" ], [ 1164, "^158.108.*.*" ], [ 1179, "^168.188.*.*" ], [ 1180, "^168.188.*.*" ], [ 1195, "^66.207.120.*" ], [ 1196, "^66.207.120.*" ], [ 1212, "^167.24.*.*" ], [ 1213, "^167.24.*.*" ], [ 1227, "^192.118.48.*" ], [ 1228, "^192.118.48.*" ], [ 1244, "^67.209.128.*" ], [ 1245, "^67.209.128.*" ], [ 1261, "^12.148.209.*" ], [ 1262, "^12.148.209.*" ], [ 1278, "^12.148.196.*" ], [ 1279, "^12.148.196.*" ], [ 1295, "^193.220.178.*" ], [ 1296, "^193.220.178.*" ], [ 1313, "68.65.53.71" ], [ 1314, "68.65.53.71" ], [ 1328, "^198.25.*.*" ], [ 1329, "^198.25.*.*" ], [ 1343, "^64.106.213.*" ], [ 1344, "^64.106.213.*" ], [ 1360, "^91.103.66.*" ], [ 1361, "^91.103.66.*" ], [ 1376, "^208.91.115.*" ], [ 1377, "^208.91.115.*" ], [ 1393, "^199.30.228.*" ], [ 1394, "^199.30.228.*" ], [ 1410, "^66.102.*.*" ], [ 1411, "^66.102.*.*" ], [ 1425, "^38.100.*.*" ], [ 1426, "^38.100.*.*" ], [ 1440, "^107.170.*.*" ], [ 1441, "^107.170.*.*" ], [ 1456, "^149.20.*.*" ], [ 1457, "^149.20.*.*" ], [ 1471, "^38.105.*.*" ], [ 1472, "^38.105.*.*" ], [ 1486, "^74.125.*.*" ], [ 1487, "^74.125.*.*" ], [ 1501, "^66.150.14.*" ], [ 1502, "^66.150.14.*" ], [ 1517, "^54.176.*.*" ], [ 1518, "^54.176.*.*" ], [ 1532, "^38.100.*.*" ], [ 1533, "^38.100.*.*" ], [ 1547, "^184.173.*.*" ], [ 1548, "^184.173.*.*" ], [ 1563, "^66.249.*.*" ], [ 1564, "^66.249.*.*" ], [ 1578, "^128.242.*.*" ], [ 1579, "^128.242.*.*" ], [ 1594, "^72.14.192.*" ], [ 1595, "^72.14.192.*" ], [ 1610, "^208.65.144.*" ], [ 1611, "^208.65.144.*" ], [ 1627, "^74.125.*.*" ], [ 1628, "^74.125.*.*" ], [ 1642, "^209.85.128.*" ], [ 1643, "^209.85.128.*" ], [ 1659, "^216.239.32.*" ], [ 1660, "^216.239.32.*" ], [ 1676, "^74.125.*.*" ], [ 1677, "^74.125.*.*" ], [ 1691, "^207.126.144.*" ], [ 1692, "^207.126.144.*" ], [ 1709, "^173.194.*.*" ], [ 1710, "^173.194.*.*" ], [ 1725, "^64.233.160.*" ], [ 1726, "^64.233.160.*" ], [ 1742, "^72.14.192.*" ], [ 1743, "^72.14.192.*" ], [ 1758, "^66.102.*.*" ], [ 1759, "^66.102.*.*" ], [ 1773, "^64.18.*.*" ], [ 1774, "^64.18.*.*" ], [ 1787, "^194.52.68.*" ], [ 1788, "^194.52.68.*" ], [ 1803, "^194.72.238.*" ], [ 1804, "^194.72.238.*" ], [ 1820, "^62.116.207.*" ], [ 1821, "^62.116.207.*" ], [ 1837, "^212.50.193.*" ], [ 1838, "^212.50.193.*" ], [ 1854, "^69.65.*.*" ], [ 1855, "^69.65.*.*" ], [ 1868, "^50.7.*.*" ], [ 1869, "^50.7.*.*" ], [ 1881, "^131.212.*.*" ], [ 1882, "^131.212.*.*" ], [ 1897, "^46.116.*.* " ], [ 1898, "^46.116.*.* " ], [ 1913, "^62.90.*.*" ], [ 1914, "^62.90.*.*" ], [ 1927, "^89.138.*.*" ], [ 1928, "^89.138.*.*" ], [ 1942, "^82.166.*.*" ], [ 1943, "^82.166.*.*" ], [ 1957, "^85.64.*.*" ], [ 1958, "^85.64.*.*" ], [ 1971, "^85.250.*.*" ], [ 1972, "^85.250.*.*" ], [ 1986, "^89.138.*.*" ], [ 1987, "^89.138.*.*" ], [ 2001, "^93.172.*.*" ], [ 2002, "^93.172.*.*" ], [ 2016, "^109.186.*.*" ], [ 2017, "^109.186.*.*" ], [ 2032, "^194.90.*.*" ], [ 2033, "^194.90.*.*" ], [ 2047, "^212.29.192.*" ], [ 2048, "^212.29.192.*" ] ], "sz": 4610, "ts": [ { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 2668.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.8199999928474426, "d": "Hostname profile field", "e": [ "hostname" ], "i": "objectives/discovery/system/profile::host-profile-hostname-field", "l": 1 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request/client::http-versions", "l": 1 }, { "c": 0.8199999928474426, "d": "Detects overwrite-mode file open", "e": [ "fopen($count_hits, \"w\"" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 52.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "HTTP/1.0 protocol version", "e": [ "HTTP/1.0 404 Not Found" ], "i": "micro-behaviors/communications/http/protocol::http-1-0-header", "l": 2 }, { "a": "T1562.001", "c": 0.8999999761581421, "d": "SafeBoot cleanup targets major EDR vendor", "e": [ "trendmicro" ], "i": "objectives/impact/degrade/edr/teardown::safeboot-edr-vendor--rx-4", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "HTTP/1." ], "i": "micro-behaviors/communications/http/request/client::http-version", "l": 2, "m": "C0002" }, { "c": 0.800000011920929, "d": "Writes a string to an open file", "e": [ "fputs" ], "i": "micro-behaviors/fs/write/file/direct::fputs", "l": 3, "m": "C0052" }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 } ], "sha": "92f2e61b0903b0a5b87c28de6f94a8148f0794e2361c10b9c1d5134af4da09df", "path": "antibots2.php", "type": "php" } ], "tv": "bef72" } }